T09 · Insecure Skill Coding Practices
- Location
references/campus-services.md:74- Finding
Predictable Default Credential Schemes Disclosed in Skill Documentation
- Content
View full analysis
Vulnerability Details
File Location:
references/campus-services.md, lines 74 and 136
Vulnerability Type: Predictable default credentials and disclosure of credential derivation rules
Risk Level: MediumEvidence
Faithful English translation of the relevant documentation:
text Password: The initial password is the last six digits of the identity card.text Before enrollment, the login name is the identity card number. If the final character is X, use lowercase x. The initial password is `qfnu` followed by the 14-digit candidate number, for example `qfnu26378112345678`.Technical Analysis
The documentation exposes deterministic formulas used to derive initial credentials from identity and admissions information. These formulas provide no user-specific secret beyond data that may be known to acquaintances, included in enrollment documents, exposed through social engineering, or obtained from leaked records.
Publicly documenting the formulas reduces the information required to attempt unauthorized authentication. The risk is greatest before a student activates the account or changes the initial password. The documentation does advise users to set a new password during first login, but it does not establish that the system technically forces a credential change before access is granted.
Exploitation depends on the relevant default credential remaining active and the attacker obtaining the associated identity-card or candidate number. The audit did not test the external university systems, so active exploitability is not confirmed.
Attack Path
- An attacker identifies a newly admitted student.
- The attacker obtains the student's identity-card number, candidate number, or relevant portions of those values through leaked enrollment material, exposed documents, acquaintances, or social engineering.
- The attacker derives the username and initial password using the formulas disc ...[truncated 1170 chars]
- Remediation
View remediation
Remediation Suggestions
- Remove deterministic default-password formulas from the Skill documentation. Link users to the official account activation and recovery instructions instead.
- Replace derived default passwords with random, single-use activation tokens delivered through a verified out-of-band channel.
- Require a password change before granting access to any account data or connected application.
- Expire unused activation credentials after a short period and invalidate them immediately after first use.
- Enable multifactor authentication, particularly for first login, password recovery, and access from unfamiliar devices.
- Apply rate limiting, progressive delays, account lockout controls, and monitoring for repeated authentication attempts against newly created accounts.
- Avoid using identity-card numbers as public-facing usernames where feasible. If they must be used internally, prevent account enumeration and mask them in logs and interfaces.
- Add explicit guidance telling students never to share identity-card numbers, candidate numbers, activation codes, or passwords and to contact university IT if a default credential is still accepted.
- Ensure all authentication and activation endpoints use verified HTTPS connections before users submit credentials.